CVE-2010-5106

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-51077.5The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, w CVE-2010-51087.5Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the statu CVE-2010-51094.3Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of servic CVE-2010-51104.3DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.CVE-2010-51116.8Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute a CVE-2010-51375.0wxBitcoin and bitcoind before 0.3.5 allow remote attackers to cause a denial of service (daemon crash) via a Bitcoin transaction containing CVE-2010-51385.0wxBitcoin and bitcoind 0.3.x allow remote attackers to cause a denial of service (electricity consumption) via a Bitcoin transaction contain CVE-2010-51397.5Integer overflow in wxBitcoin and bitcoind before 0.3.11 allows remote attackers to bypass intended economic restrictions and create many bi CVE-2010-51405.0wxBitcoin and bitcoind before 0.3.13 do not properly handle bitcoins associated with Bitcoin transactions that have zero confirmations, whic CVE-2010-51417.5wxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions, which allows remote attackers to spend bi CVE-2010-51426.5chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy,CVE-2010-51432.6McAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging administrative privileges to execute an unspe